With the growing application of communication networks, individuals attach increasing importance to security and prevention of threats within communication networks. To this end, a range of security services can be activated on a gateway, such as Intrusion Detection/Protection System (IPS), anti virus, anti spam, content filter (CF) (i.e., firewall), and worm filter (WF), as shown in FIG. 1 according to the prior art. However, a single threat security service in a single device is not an effective solution because of the uncontrolled expenses of on-site administration and troubleshooting. Many platforms offer a multitude of security services in one Unified Threat Management (UTM) device, which is a combination of the above security services with a firewall and which is used by enterprises and service providers to increase their security while reducing total operating costs.
A common characteristic among the aforementioned security threat security services is that they all need to scan the entire packet data to obtain corresponding application data. That is to say, each threat security service has its own protocol stack, and each always parses the packet data to obtain corresponding application data. Illustration will be provided in the context of an example according to the prior art, as shown in FIG. 2. When an IP packet enters a gateway, it first enters a firewall threat security service, which performs parsing to determine whether to apply a corresponding threat security service to the packet. If the firewall threat security service does not need to be provided, then the packet enters an Intrusion Detection/Protection threat security service, at which parsing processing is again performed on the packet in order to obtain application data required by the Intrusion Detection/Protection threat security service so that it may be determined whether the Intrusion Detection/Protection threat security service should be applied to this incoming packet. Similar steps are performed until for the rest of the preset multiple threat security services (e.g., the Content Filter, Worm Filter, and Anti Virus Anti Spam threat security services as shown in FIG. 2). Along with an increasing number of integrated threat security services and growth of computation complicacy, protocol parsing has been one of the most computation-intensive operations. This situation is a significant obstacle against UTM's popularity.
In view of this situation, current mechanisms focus on hardware acceleration to improve UTM performance, such as Fortinet's FortiGate, which is an ASIC-accelerated multi-threat security system. However, only some security services can be integrated into Fortinet's UTM device.
Therefore, there is currently a need for a more complete solution for integrating multiple threat security services that can reduce computation overhead.